Privacy Notice

This notice explains what personal data Casper Gadgets collects when you use this website, why we collect it, who we share it with, and the rights you have over it. It is written to meet the Nigeria Data Protection Act 2023 (NDPA), which is administered by the Nigeria Data Protection Commission (NDPC).

Who is responsible for your data

The data controller is Casper Gadgets Solution, of 5a Somoye Osundairo Street, Ikeja, Lagos, Nigeria, trading as Casper Gadgets at https://caspergadgets.com.

You can reach the Data Protection Contact, Casper Gadgets Solution, at info@caspergadgets.com. Please do not email your card number, your bank details or any other sensitive information.

What we collect, and where it comes from

Information you give us

• To place an order — your email address, your phone number, and the delivery address you type in (state, location within Lagos where that applies, and the street address).
• To hold an account — your email address and a password. The password is stored only as a one-way hash; nobody at Casper Gadgets can read it.
• Saved addresses and saved items — only if you choose to save them to your account.
• When you contact us — whatever you tell us by phone, email or in one of our stores.

Information we collect automatically

• Order records — what you bought, the price at the time, the delivery fee, the payment method, and the date. Prices are recorded as a snapshot so your order is unaffected by any later price change.
• Technical and usage information — your IP address, browser and device type, the pages you view, and the page you arrived from. Some of this reaches Google Analytics only if you accept analytics cookies.
• Error reports — when something breaks, a diagnostic report is sent to Sentry. It can include your IP address and the page you were on.
• A cart identifier — a random value stored on your device so your basket survives a page reload. It is not linked to you until you sign in.

What we never collect

We never see or store your full card number, expiry date or CVV. Those are entered on Paystack's own secure form and never reach this website or our database. We do not ask for your Bank Verification Number, your National Identification Number, or any other government identifier. We do not ask for your gender, your date of birth, or your income.

Why we process it, and our lawful basis

The NDPA requires a lawful basis for each purpose. Ours are set out below. Where the basis is your consent, you can withdraw it at any time and we stop; where the basis is the performance of our contract with you, we cannot stop and still deliver your order.

• Taking, fulfilling and delivering your order — performance of a contract with you. Without your address and phone number we cannot deliver a ₦1M laptop to you.
• Taking payment — performance of a contract with you, and compliance with a legal obligation for the records we must keep of a sale.
• Keeping you informed about your order — performance of a contract with you. You cannot opt out of these emails; they are how you learn that your order shipped.
• Running and securing the website, and investigating fraud — our legitimate interest in a shop that works and is not defrauded, balanced against your interests. A single order here can be ₦1.4M, so we treat this seriously.
• Keeping accounting and tax records — compliance with a legal obligation.
• Analytics — understanding how the site is used — your consent, given through the cookie banner. Decline it and Google Analytics receives no identifiers from you.
• Marketing emails, where you have asked for them — your consent. Every marketing email carries an unsubscribe link.

Who we share it with

We do not sell, rent or trade your personal data. We share it with the service providers we need to run the shop, and only what each one needs:

• Paystack (Nigeria) — card payments. Paystack receives your email, the amount and a reference, and handles your card details directly.
• Keystone Bank (Nigeria) — where you pay by bank transfer, your payment reaches our account and our staff match it to your order reference.
• Supabase — the database that holds your account, addresses and orders, and the sign-in service that authenticates you.
• Vercel — hosts and serves this website, so every request you make passes through it.
• Sanity — holds our product content and pages. It receives no customer data.
• Resend — sends our transactional email, so it receives your email address and the contents of the message.
• Sentry — receives error reports, which can include your IP address.
• Google Analytics — receives usage data only if you accept analytics cookies.
• Delivery partners — receive your name, address and phone number so they can deliver to you.

We may also disclose personal data where the law requires it — in response to a court order, or a lawful request from a regulator or law-enforcement agency — and where disclosure is necessary to establish, exercise or defend a legal claim, or to prevent fraud.

If our business is sold or merged, your personal data may transfer to the buyer, and that transfer stays subject to a notice at least as protective as this one.

Transfers outside Nigeria

Several of the providers above operate outside Nigeria. Vercel, Supabase, Sanity, Resend, Sentry and Google Analytics all store and process data on infrastructure located abroad, principally in the European Union and the United States. This means a transfer of your personal data out of Nigeria happens whenever you use this website, not just occasionally.

The NDPA permits such transfers where an adequate level of protection is ensured. We rely on our contracts with each provider, which bind them to process the data only on our instructions and to keep it secure, and on the data-protection frameworks those providers operate under in their own jurisdictions. You can ask us for further detail about a specific provider.

Your rights

Under the NDPA you have the right to:

• ask what personal data we hold about you, and get a copy of it;
• have inaccurate or incomplete data about you corrected;
• ask us to delete data we no longer have a lawful reason to keep;
• ask us to restrict how we use your data while a dispute about it is resolved;
• object to processing we carry out on the basis of our legitimate interest;
• withdraw a consent you have given — for analytics cookies or marketing email — at any time, without affecting anything done before you withdrew it;
• receive your data in a portable form, or have it sent to another controller, where that is technically feasible;
• not be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. We do not make such decisions.

To exercise any of these, email info@caspergadgets.com. We will respond within one month. If we cannot do what you ask, we will tell you why.

If you are not satisfied with how we have handled your data or your request, you can complain to the Nigeria Data Protection Commission.

Opt out and corrections

Upon your request, we will (a) correct or update your personal information; (b) stop sending marketing emails to your email address; and/or (c) disable your account to prevent any future purchases through that account. You can make these requests by emailing us at info@caspergadgets.com. Please do not email your card number or other sensitive information.

How long we keep it

• Order and payment records — kept for as long as the law requires us to retain accounting records, and no longer.
• Your account — kept while the account is open. Ask us to close it and we delete or anonymise what we are not required to keep.
• Delivery addresses you saved — until you delete them or close your account.
• Abandoned baskets and cart identifiers — a short period, then deleted automatically.
• Error reports and technical logs — a limited retention period set by each provider, after which they are deleted.

Keeping it secure

We take reasonable measures, including administrative, technical, and physical safeguards, to protect information about you from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Traffic to this site is encrypted in transit. Passwords are stored as one-way hashes. Access to the database and to the admin tools is restricted to named staff accounts, and staff actions on orders are recorded in an append-only audit log.

If there is a breach

If a breach of personal data occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Nigeria Data Protection Commission without undue delay, and we will tell you directly where the risk to you is high. We will explain what happened, what data was involved, and what you can do about it.

Registration with the NDPC

The NDPA imposes a registration duty on a data controller or processor of major importance. Whether Casper Gadgets falls into that category turns on the volume of data subjects whose data we process and the nature of that data. On volume, this is a low-volume, high-value catalogue rather than a mass-market service. On sensitivity, we process contact and delivery details and no special categories of data, no government identifiers and no financial-instrument data. Our assessment is therefore that the threshold is not obviously met — but the applicable threshold and the filing deadline are set by current NDPC directives and must be confirmed against them before this conclusion is relied on.

Children

We respect children's privacy. We do not knowingly or intentionally collect personal information from children. This site is intended for users who are at least 18 years old, and persons under 18 are not permitted to register. If you are under 18, please do not submit any personal information to us, and rely on a parent or guardian to assist you.

Cookies

What we store on your device, which of it you can decline, and who the third parties are, is set out in our Cookie Policy.

Information collected offline

We also may collect information offline, and we treat it in a manner consistent with this notice. One example is someone calling us to place an order or to ask a question: we ask only for the personal information needed to place the order or answer the question, and where we need to store it, we enter it into our systems.

Data you send to the site

We will maintain certain data that you transmit to the Site for the purpose of managing the performance of the Site, as well as data relating to your use of the Site. Although we perform regular routine backups of data, you are solely responsible for all data that you transmit or that relates to any activity you have undertaken using the Site. You agree that we shall have no liability to you for any loss or corruption of any such data, and you hereby waive any right of action against us arising from any such loss or corruption of such data.

Electronic communications, transactions and signatures

Visiting the Site, sending us emails, and completing online forms constitute electronic communications. You consent to receive electronic communications, and you agree that all agreements, notices, disclosures, and other communications we provide to you electronically, via email and on the Site, satisfy any legal requirement that such communication be in writing.

YOU HEREBY AGREE TO THE USE OF ELECTRONIC SIGNATURES, CONTRACTS, ORDERS, AND OTHER RECORDS, AND TO ELECTRONIC DELIVERY OF NOTICES, POLICIES, AND RECORDS OF TRANSACTIONS INITIATED OR COMPLETED BY US OR VIA THE SITE.

Changes to this notice

If we change or update this notice, we will post the change here and move the “Last updated” date at the top of this page. We encourage you to review it from time to time so you know if it has changed.

Contact

Questions about this notice, or about how we handle your personal data: the Data Protection Contact, Casper Gadgets Solution, info@caspergadgets.com, or 5a Somoye Osundairo Street, Ikeja, Lagos, Nigeria.